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Art Unit: 2167 

This is in response to the appeal brief filed 12/30/2010 appealing from the Office action mailed 
07/21/2010. 

(1) Real Party in Interest 

A statement identifying by name the real party in interest contained in the brief. 

(2) Related Appeals and Interferences 

The examiner is not aware of any related appeals, interferences, or judicial proceedings 
which will directly affect or be directly affected by or have a bearing on the Board's decision in 
the pending appeal. 

09/167092 never went to the board of appeals but instead was allowed after a subsequent 
appeal brief filed after final rejection by applicants of that case. 

(3) Status of Claims 

The following is a list of claims that are rejected and pending in the application: 
Claims 1-26. 

(4) Status of Amendments After Final 

The examiner has no comment on the appellant's statement of the status of amendments 
after final rejection contained in the brief. 



(5) Summary of Claimed Subject Matter 
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The examiner has no comment on the summary of claimed subject matter contained in 
the brief. 

(6) Grounds of Rejection to be Reviewed on Appeal 

The examiner has no comment on the appellant's statement of the grounds of rejection to 
be reviewed on appeal. Every ground of rejection set forth in the Office action from which the 
appeal is taken (as modified by any advisory actions) is being maintained by the examiner except 
for the grounds of rejection (if any) listed under the subheading "WITHDRAWN 
REJECTIONS." New grounds of rejection (if any) are provided under the subheading "NEW 
GROUNDS OF REJECTION." 

WITHDRAWN REJECTIONS 

The following grounds of rejection are not presented for review on appeal because they 
have been withdrawn by the examiner. The rejections of claims 1-26 under 35 U.S.C. 1 12 first 
and second paragraph are withdrawn. 

(7) Claims Appendix 

The examiner has no comment on the copy of the appealed claims contained in the 
Appendix to the appellant's brief. 



(8) Evidence Relied Upon 

20050050046 Puz et. al. 

20030014394 Fujiwara et. al. 



8-2003 
3-2001 
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(9) Grounds of Rejection 

The following ground(s) of rejection are applicable to the appealed claims: 

Claim Rejections - 35 USC § 102 

1. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the 
basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 
122(b), by another filed in the United States before the invention by the applicant for 
patent or (2) a patent granted on an application for patent by another filed in the United 
States before the invention by the applicant for patent, except that an international 
application filed under the treaty defined in section 351(a) shall have the effects for 
purposes of this subsection of an application filed in the United States only if the 
international application designated the United States and was published under Article 
21(2) of such treaty in the English language. 

2. Claims 1-4, 6-9, 14-21, and 26 are rejected under 35 U.S.C. 102(e) as being 
anticipated by U.S. 20050050046 by Puz et. al. (hereafter Puz). 

Claim 1 : 

Puz discloses the following claimed limitations: 

"a database server receiving a request to execute the database statement, wherein the 
request includes the database statement and a tag that does not conform to a database language of 
said database statement, wherein said tag is not embedded in said database statement;"[See 
figure 2. Accordingly, a database server (figure 2, element 16) receiving a request (figure 2 
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elements 34, 36, 38) to execute the database statement (figure 2 elements 40, 42, 44), wherein 
the request (figure 2 elements 34, 36, 38) includes the database statement (figure 2 elements 40, 
42, 44) and a tag (figure 2 elements 46, 48, 50) that does not conform to a database language of 
said database statement (figure 2, security markers not sql), wherein said tag (figure 2 element 
46, 48, and 50) is not embedded in said database statement (figure 2, SQL part and security 
marker)] 

"wherein said tag specifies at least one parameter field and at least one parameter 
value;"[figure 2 elements 46, 48, 50. Accordingly, wherein said tag (46, 48, 50) specifies at least 
one parameter field (marker 1, 2, 3) and at least one parameter value (employee_3, journal_l, 
none)] 

"in response to receiving the request, said database server storing information from the 
tag in a manner that is associated with said database statement and accessible to a tag 
access mechanism:"[figure 2 and figure 3. Accordingly, in response to receiving the request 
(figure 2 elements 34, 36, 38), said database server (figure 2 element 16) storing information 
from the tag (figure 2 element 46, 48, 50) in a manner that is associated with said database 
statement (figure 2 element 40, 42, 44) and accessible to a tag access mechanism (0030, Access 
Control List checks)] 

"said database server executing said database statement, wherein during execution of said 
database statement said database server provides access to one or more of the at least one 
parameter value through said tag access mechanism provided by said database server."[figure 2 
and 4. Accordingly, said database server executing said database statement (figure 4 elements 
82-86), wherein during execution of said database statement (figure 4 elements 82-86) said 
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database server (figure 2 element 16) provides access to one or more of the at least one 
parameter value (figure 4 element 82, a marker part to a server system for processing) through 
said tag access mechanism (figure 4 element 84, ACL checks on the markers) provided by said 
database server (figure 2 element 16)] 
Claim 2 : 

Puz discloses "wherein the database statement is written in a language in which results desired 
are specified by the database statement, and no procedures for obtaining the results desired are 
specified by the database statement. "[ Figure 2 and 0029-0030. Accordingly, wherein the 
database statement is written in a language in which results desired are specified by the database 
statement (SQL part), and no procedures (SQL part does not contain security marker) for 
obtaining the results desired are specified by the database statement (SQL part)] 
Claim 3 : 

Puz discloses "wherein a priority for executing the database statement is determined based on the 
at least one parameter value. "[ Figure 2. 0027, proper access permissions. Accordingly, wherein 
a priority (proper access permissions) for executing the database statement (SQL) is determined 
based on the at least one parameter value (security marker)] 
Claim 4 : 

Puz discloses "wherein a security level is associated with the at least one parameter such that 
whether the database is entitled to access a component is based on the at least one parameter."[ 
Figure 2. 0027, proper access permissions. Accordingly, wherein a security level (proper 
access permissions) is associated with the at least one parameter (security marker) such that 
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whether the database is entitled to access a component is based on the at least one parameter 
(access permissions)] 
Claim 6 : 

Puz discloses "wherein the at least one parameter is related to user context information."[figure 
2. 0027, user had proper access permission. Accordingly, wherein the at least one parameter 
(figure 2 element 46, 48, 50) is related to user context information (user had proper access 
permission)] 
Claim 7 : 

Puz discloses "wherein the tag comprises an indicator of a beginning of the tag, and an indicator 
of an end of the tag " [See figure 2 and figure 3. Accordingly, wherein the tag (figure 2 elements 
46, 48, 50) comprises an indicator of a beginning of the tag(figure 3, "(" ), and an indicator of an 
end of the tag (figure 3, ")" )] 
Claim 8 : 

Puz discloses "wherein the at least one parameter value is located between the indicator of the 
beginning and the indicator of the end of the tag."[ figure 3. Accordingly, wherein the at least 
one parameter value (figure 3 element 62, select ) is located between the indicator of the 
beginning (figure 3 element 62, "(") and the indicator of the end of the tag (figure 3 element 62 
")")] 

Claim 9 : 

Puz discloses "wherein each of the at least one parameter fields comprises an indicator of a 
beginning of the parameter field, followed by the parameter value, which in turn is followed by 
an indicator of an end of the parameter field. "[ Figure 3. Accordingly, wherein each of the at 
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least one parameter fields (figure 3 element 62, exists) comprises an indicator of a beginning of 
the parameter field (figure 3 element 62 "(" ), followed by the parameter value (figure 3 element 
62, select), which in turn is followed by an indicator of an end of the parameter field (figure 3 
element 62, ")")•] 
Claim 14 : 

Puz discloses the following claimed limitations: 

"a database server receiving a request to execute the database statement, wherein the 
request includes the database statement and a tag that does not conform to a database language of 
said database statement, wherein said tag is not embedded in said database statement;"[See 
figure 2. Accordingly, a database server (figure 2, element 16) receiving a request (figure 2 
elements 34, 36, 38) to execute the database statement (figure 2 elements 40, 42, 44), wherein 
the request (figure 2 elements 34, 36, 38) includes the database statement (figure 2 elements 40, 
42, 44) and a tag (figure 2 elements 46, 48, 50) that does not conform to a database language of 
said database statement (figure 2, security markers not sql), wherein said tag (figure 2 element 
46, 48, and 50) is not embedded in said database statement (figure 2, SQL part and security 
marker)] 

"wherein said tag specifies at least one parameter field and at least one parameter 
value;"[figure 2 elements 46, 48, 50. Accordingly, wherein said tag (46, 48, 50) specifies at least 
one parameter field (marker 1, 2, 3) and at least one parameter value (employee_3, journal_l, 
none)] 

"in response to receiving the request, said database server storing information from the 
tag in a manner that is associated with said database statement and accessible to a tag 
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access mechanism: "[figure 2 and figure 3. Accordingly, in response to receiving the request 
(figure 2 elements 34, 36, 38), said database server (figure 2 element 16) storing information 
from the tag (figure 2 element 46, 48, 50) in a manner that is associated with said database 
statement (figure 2 element 40, 42, 44) and accessible to a tag access mechanism (0030, Access 
Control List checks)] 

"said database server executing said database statement, wherein during execution of said 
database statement said database server provides access to one or more of the at least one 
parameter value through said tag access mechanism provided by said database server."[figure 2 
and 4. Accordingly, said database server executing said database statement (figure 4 elements 
82-86), wherein during execution of said database statement (figure 4 elements 82-86) said 
database server (figure 2 element 16) provides access to one or more of the at least one 
parameter value (figure 4 element 82, a marker part to a server system for processing) through 
said tag access mechanism (figure 4 element 84, ACL checks on the markers) provided by said 
database server (figure 2 element 16)] 
Claim 15 : 

Puz discloses "wherein the database statement is written in a language in which results desired 
are specified by the database statement, but no procedures for obtaining the results desired are 
specified by the database statement."[ Figure 2 and 0029-0030. Accordingly, wherein the 
database statement is written in a language in which results desired are specified by the database 
statement (SQL part), but no procedures (SQL part does not contain security marker) for 
obtaining the results desired are specified by the database statement (SQL part)] 
Claim 16 : 
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Puz discloses "wherein a priority for executing the database statement is determined based on the 
at least one parameter value. "[ Figure 2. 0027, proper access permissions. Accordingly, wherein 
a priority (proper access permissions) for executing the database statement (SQL) is determined 
based on the at least one parameter value (security marker)] 
Claim 18 : 

Puz discloses "wherein the at least one parameter is related to user context information."[figure 
2. 0027, user had proper access permission. Accordingly, wherein the at least one parameter 
(figure 2 element 46, 48, 50) is related to user context information (user had proper access 
permission)] 
Claim 19 : 

Puz discloses "wherein the tag comprises an indicator of a beginning of the tag, and an indicator 
of an end of the tag " [See figure 2 and figure 3. Accordingly, wherein the tag (figure 2 elements 
46, 48, 50) comprises an indicator of a beginning of the tag(figure 3, "(" ), and an indicator of an 
end of the tag (figure 3, ")" )] 
Claim 20 : 

Puz discloses "wherein the at least one parameter value is located between the indicator of the 
beginning and the indicator of the end of the tag."[ figure 3. Accordingly, wherein the at least 
one parameter value (figure 3 element 62, select ) is located between the indicator of the 
beginning (figure 3 element 62, "(") and the indicator of the end of the tag (figure 3 element 62 
")")] 

Claim 21 : 
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Puz discloses "wherein each of the at least one parameter fields comprises an indicator of a 
beginning of the parameter field, followed by the parameter value, which in turn is followed by 
an indicator of an end of the parameter field."[ Figure 3. Accordingly, wherein each of the at 
least one parameter fields (figure 3 element 62, exists) comprises an indicator of a beginning of 
the parameter field (figure 3 element 62 "(" ), followed by the parameter value (figure 3 element 
62, select), which in turn is followed by an indicator of an end of the parameter field (figure 3 
element 62, ")").] 
Claim 26 : 

Puz discloses "wherein a security level is associated with the at least one parameter such 
that whether the database is entitled to access a component is based on the at least one 
parameter."[ Figure 2. 0027, proper access permissions. Accordingly, wherein a security level 
(proper access permissions) is associated with the at least one parameter (security marker) such 
that whether the database is entitled to access a component is based on the at least one parameter 
(access permissions)] 

Claim Rejections - 35 USC § 103 

3. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 

obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or 
described as set forth in section 102 of this title, if the differences between the subject 
matter sought to be patented and the prior art are such that the subject matter as a whole 
would have been obvious at the time the invention was made to a person having ordinary 
skill in the art to which said subject matter pertains. Patentability shall not be negatived 
by the manner in which the invention was made. 
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4. Claims 5, 11-13, and 22-25 rejected under 35 U.S.C. 103(a) as being unpatentable 
over U.S. 20050050046 by Puz et. al. (hereafter Puz) further in view of U.S. Patent 
Application Publication 20030014394 by Fujiwara et. al. (hereafter Fujiwara). 
Claim 5 : 

Puz does not explicitly disclose "wherein the at least one parameter is accessible to a systems 
administrator" On the other hand, Fujiwara further discloses "wherein the at least one parameter 
is accessible to a systems administrator, "[figure 8 and 0044, administrator]. Both Puz and 
Fujiwara are within the same field of endeavor as they are both access control systems for a 
database query. It would have been obvious to a person of an ordinary skill at the time the 
invention was made to have applied Fujiwara's disclosure above to the disclosure of Puz for the 
purpose of allowing an access policy to be determined in order to provide for easier management 
of access control to each user. 
Claim 10 : 

Puz does not explicitly disclose "wherein the at least one parameter value can be accessed 
without accessing memory allocated to a database session, wherein the database statement was 
issued within the database session". On the other hand, Fujiwara further discloses "wherein the 
at least one parameter value can be accessed without accessing memory allocated to a database 
session, wherein the database statement was issued within the database session"[figure 12. 
Accordingly, wherein the at least one parameter value (figure 12 element 1202, c.pt_ID, i.vst) 
can be accessed without accessing a session space (figure 12 element 1224, filter MD()) 
associated with a session window (figure 12 element 702), wherein the database statement 
(figure 12 element 1202) was issued within the session window (figure 12 element 702)]. Both 
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Puz and Fujiwara are within the same field of endeavor as they are both access control systems 
for a database query. It would have been obvious to a person of an ordinary skill at the time the 
invention was made to have applied Fujiwara's disclosure above to the disclosure of Puz for the 
purpose of allowing an access policy to be determined in order to provide for easier management 
of access control to each user. 
Claim 11 : 

Puz does not explicitly disclose "wherein the at least one parameter value can be accessed 
without accessing memory allocated to a database session, wherein the database statement was 
issued within the database session." On the other hand, Fujiwara further discloses "wherein the 
at least one parameter value can be accessed without accessing memory allocated to a database 
session, wherein the database statement was issued within the database session." [figure 12. 
Accordingly, wherein the at least one parameter value (Figure 12 element 1202, example.. 
c.PT_ID, i.VST) can be accessed (Figure 12, element 1202, Issue SQL query) without accessing 
memory allocated to a database session (figure 12 element 702), wherein the database statement 
was issued (figure 12 element 734, issued SQL query)within the database session (Figure 12 
element 734, Report templates)] Both Puz and Fujiwara are within the same field of endeavor as 
they are both access control systems for a database query. It would have been obvious to a 
person of an ordinary skill at the time the invention was made to have applied Fujiwara's 
disclosure above to the disclosure of Puz for the purpose of allowing an access policy to be 
determined in order to provide for easier management of access control to each user. 
Claim 12 : 
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Puz does not explicitly disclose "wherein the at least one parameter value can be accessed 
without accessing memory allocated to a database session, wherein the database statement was 
issued within the database session.". On the other hand, Fujiwara further discloses "wherein the 
at least one parameter value can be accessed without accessing memory allocated to a database 
session, wherein the database statement was issued within the database session." [figure 12. 
Accordingly, wherein the at least one parameter value (Figure 12 element 1202, example.. 
c.PT_ID, i.VST) can be accessed (Figure 12, element 1202, Issue SQL query) without accessing 
memory allocated to a database session (figure 12 element 702), wherein the database statement 
was issued (figure 12 element 734, issued SQL query)within the database session (Figure 12 
element 734, Report templates)] Both Puz and Fujiwara are within the same field of endeavor as 
they are both access control systems for a database query. It would have been obvious to a 
person of an ordinary skill at the time the invention was made to have applied Fujiwara' s 
disclosure above to the disclosure of Puz for the purpose of allowing an access policy to be 
determined in order to provide for easier management of access control to each user. 
Claim 13 : 

Puz does not explicitly disclose "wherein the at least one parameter value can be accessed after a 
session window has closed, wherein the database statement was issued within the session 
window." On the other hand, Fujiwara further discloses "wherein the at least one parameter 
value can be accessed after a session window has closed, wherein the database statement was 
issued within the session window." [figure 12. Accordingly, wherein the at least one parameter 
value can be accessed (figure 12 element 1202, c.PT_ID, i.VST) after a session window has 
closed (figure 12 element 734), wherein the database statement was issued within the session 
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window (figure 12 element 734 and 1202)] Both Puz and Fujiwara are within the same field of 
endeavor as they are both access control systems for a database query. It would have been 
obvious to a person of an ordinary skill at the time the invention was made to have applied 
Fujiwara' s disclosure above to the disclosure of Puz for the purpose of allowing an access policy 
to be determined in order to provide for easier management of access control to each user. 
Claim 17 : 

Puz does not explicitly disclose "wherein the at least one parameter is accessible to a systems 
administrator" On the other hand, Fujiwara further discloses "wherein the at least one parameter 
is accessible to a systems administrator, "[figure 8 and 0044, administrator]. Both Puz and 
Fujiwara are within the same field of endeavor as they are both access control systems for a 
database query. It would have been obvious to a person of an ordinary skill at the time the 
invention was made to have applied Fujiwara's disclosure above to the disclosure of Puz for the 
purpose of allowing an access policy to be determined in order to provide for easier management 
of access control to each user. 
Claim 22 : 

Puz does not explicitly disclose "wherein the at least one parameter value can be accessed 
without accessing memory allocated to a database session, wherein the database statement was 
issued within the database session". On the other hand, Fujiwara further discloses "wherein the 
at least one parameter value can be accessed without accessing memory allocated to a database 
session, wherein the database statement was issued within the database session" [figure 12. 
Accordingly, wherein the at least one parameter value (figure 12 element 1202, c.pt_ID, i.vst) 
can be accessed without accessing a session space (figure 12 element 1224, filter MD()) 
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associated with a session window (figure 12 element 702), wherein the database statement 
(figure 12 element 1202) was issued within the session window (figure 12 element 702)]. Both 
Puz and Fujiwara are within the same field of endeavor as they are both access control systems 
for a database query. It would have been obvious to a person of an ordinary skill at the time the 
invention was made to have applied Fujiwara's disclosure above to the disclosure of Puz for the 
purpose of allowing an access policy to be determined in order to provide for easier management 
of access control to each user. 
Claim 23 : 

Puz does not explicitly disclose "wherein the at least one parameter value can be accessed 
without accessing memory allocated to a database session, wherein the database statement was 
issued within the database session." On the other hand, Fujiwara further discloses "wherein the 
at least one parameter value can be accessed without accessing memory allocated to a database 
session, wherein the database statement was issued within the database session." [figure 12. 
Accordingly, wherein the at least one parameter value (Figure 12 element 1202, example.. 
c.PT_ID, i.VST) can be accessed (Figure 12, element 1202, Issue SQL query) without accessing 
memory allocated to a database session (figure 12 element 702), wherein the database statement 
was issued (figure 12 element 734, issued SQL query)within the database session (Figure 12 
element 734, Report templates)] Both Puz and Fujiwara are within the same field of endeavor as 
they are both access control systems for a database query. It would have been obvious to a 
person of an ordinary skill at the time the invention was made to have applied Fujiwara's 
disclosure above to the disclosure of Puz for the purpose of allowing an access policy to be 
determined in order to provide for easier management of access control to each user. 
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Claim 24 : 

Puz does not explicitly disclose "wherein the at least one parameter value can be accessed 
without accessing memory allocated to a database session, wherein the database statement was 
issued within the database session.". On the other hand, Fujiwara further discloses "wherein the 
at least one parameter value can be accessed without accessing memory allocated to a database 
session, wherein the database statement was issued within the database session." [figure 12. 
Accordingly, wherein the at least one parameter value (Figure 12 element 1202, example.. 
c.PT_ID, i.VST) can be accessed (Figure 12, element 1202, Issue SQL query) without accessing 
memory allocated to a database session (figure 12 element 702), wherein the database statement 
was issued (figure 12 element 734, issued SQL query)within the database session (Figure 12 
element 734, Report templates)] Both Puz and Fujiwara are within the same field of endeavor as 
they are both access control systems for a database query. It would have been obvious to a 
person of an ordinary skill at the time the invention was made to have applied Fujiwara's 
disclosure above to the disclosure of Puz for the purpose of allowing an access policy to be 
determined in order to provide for easier management of access control to each user. 
Claim 25 : 

Puz does not explicitly disclose "wherein the at least one parameter value can be accessed after a 
session window has closed, wherein the database statement was issued within the session 
window." On the other hand, Fujiwara further discloses "wherein the at least one parameter 
value can be accessed after a session window has closed, wherein the database statement was 
issued within the session window." [figure 12. Accordingly, wherein the at least one parameter 
value can be accessed (figure 12 element 1202, c.PT_ID, i.VST) after a session window has 
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closed (figure 12 element 734), wherein the database statement was issued within the session 
window (figure 12 element 734 and 1202)] Both Puz and Fujiwara are within the same field of 
endeavor as they are both access control systems for a database query. It would have been 
obvious to a person of an ordinary skill at the time the invention was made to have applied 
Fujiwara' s disclosure above to the disclosure of Puz for the purpose of allowing an access policy 
to be determined in order to provide for easier management of access control to each user. 



(10) Response to Argument 

Appellant's primarily assert the following with regard to the cited references: 

A. Page 10 of the appeal brief, Puz does not show a tag that is (a) included in a 
request to execute a database statement, and (b) not embedded in the database statement. 
Page 10 of the appeal brief, that the limitation is not disclosed because the claimed 
embodiment features a tag that is received with the database statement even though the tag 
is not embedded in the database statement and does not conform to a database language of 
the database statement. Page 11 of the appeal brief, that because the security marker is a 
placeholder that the security marker is embedded as a place holder in a database 
statement. 
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Regarding the limitations, it is disagreed that Puz does not show a tag that is (a) 
included in a request to execute a database statement, and (b) not embedded in the database 
statement. The limitation states "a database server receiving a request to execute the database 
statement, wherein the request includes the database statement and a tag that does not conform 
to a database language of said database statement, wherein said tag is not embedded in said 
database statement. " See figure 2 of Puz. Accordingly, a database server (figure 2, element 16) 
receiving a request (figure 2 elements 34, 36, 38) to execute the database statement (figure 2 
elements 40, 42, 44), wherein the request (figure 2 elements 34, 36, 38) includes the database 
statement (figure 2 elements 40, 42, 44) and a tag (figure 2 elements 46, 48, 50) that does not 
conform to a database language of said database statement (figure 2, security markers not sql), 
wherein said tag (figure 2 element 46, 48, and 50) is not embedded in said database statement 
(figure 2, SQL part and security marker). 

In otherwords, a tag (figure 2 elements 46, 48, 50) that is (a) included in a request (figure 
2 element 34, 36, 38) to execute a database statement (figure 2 elements 40, 42, 44), and (b) not 
embedded in the database statement (figure 2, sql part and security part; figure 4 element 80, 
inserted) 

Regarding page 10 of the appeal brief, that the limitation is not disclosed because the 
claimed embodiment features a tag that is received with the database statement even though the 
tag is not embedded in the database statement and does not conform to a database language of 
the database statement, it is disagreed that Puz does not disclose this. 
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Appellant's specification states on paragraph 22 that a tag may be "appended to, attached 
to , sent with, embedded in or otherwise associated with a database statement." 

Appellant's further state in the appeal brief that the tag not embedded is supported on 
page 4 lines 8-9 and page 5 lines 12-15 by stating that, "The tag is not embedded in said database 
statement. See for example, pars. 17 (tags 'appended to database statements'), 18 ('binding a tag 
to each database statement'), 22(tag 'appended to, attached to, sent with, embedded in or 
otherwise associated with database statement". In other words, not embedded in appellant's 
application means to "appended to, attached to , sent with, embedded in or otherwise associated 
with a database statement." 

The security marker (tag) is received with the database statement, see figure 2 elements 
46, 48, 50 and figure 4 element 80 of Puz. The security marker is inserted (e.g. appended to) the 
database statement and therefore not embedded as appellant's claim, see figure 2 elements 46, 
48, 50 and figure 4 element 80 of Puz. Furthermore, the security marker (tag) does not conform 
to the database language because it must be translated see at least paragraph 38 of Puz since the 
security marker must be interpreted. Simply put, if the security marker were to conform then it 
would not need to be translated at all. 

Regarding, page 10-11 that because the security marker is a placeholder that the security 
marker is embedded as a place holder in a database statement in paragraphs 28 and 33 of Puz 
et. al. In response, this is disagreed because the security marker is inserted to the database 
statement see figure 4 element 80; and therefore the security marker is appended to, attached to, 
sent with, or otherwise associated with a database statement. 
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Appellant's specification states on paragraph 22 that a tag may be "appended to, attached 
to , sent with, embedded in or otherwise associated with a database statement." 

Appellant's further state in the appeal brief that the tag not embedded is supported on 
page 4 lines 8-9 and page 5 lines 12-15 by stating that, "The tag is not embedded in said database 
statement. See for example, pars. 17 (tags 'appended to database statements'), 18 ('binding a tag 
to each database statement'), 22(tag 'appended to, attached to, sent with, embedded in or 
otherwise associated with database statement". In other words, not embedded in appellant's 
application means to "appended to, attached to , sent with, embedded in or otherwise associated 
with a database statement." 

The security marker is inserted to the database statement see figure 4 element 80; and 
therefore the security marker is appended to, attached to, sent with, or otherwise associated with 
a database statement. 

Furthermore, the security marker does not conform to the database language because it 
must be translated see at least paragraph 38 of Puz since the security marker must be interpreted. 
Simply put, if the security marker were to conform then it would not need to be translated at all. 

Lastly, even without considering Appellant's admission above in page 4 lines 8-9 and 
page 5 lines 12-15 of the appeal brief of what not embedded means. The Puz reference still 
discloses a security marker not embedded and not conforming to the database statement as can 
be seen in figure 2 of security marker 3, since the security marker 3 does not exist it is not 
embedded nor does it conform to the database statement. 
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B. Page 12, that the rest of the limitations " wherein said tag specifies at least one 
parameter field and at least one parameter value; in response to receiving the request, said 
database server storing information from the tag in a manner that is associated with said 
database statement and accessible to a tag access mechanism: said database server 
executing said database statement, wherein during execution of said database statement 
said database server provides access to one or more of the at least one parameter value 
through said tag access mechanism provided by said database server" because Puz does not 
show a database server that has access to a parameter value of the tag during execution of 
the database statement. That Puz does not use the security marker during execution of the 
database statement. That puz replaces the security marker prior to execution of the 
database statement. That the security marker is replaced before the SQL string is 
submitted to the database server. That the database server in Puz does not receive the 
security marker. That therefore, Puz fails to show a database server that has access to a 
parameter value of the tag during execution of the database statement, as claimed, and 
further could not possibly accessed any parameter values of the security marker during 
execution of the database statement. 

Regarding the limitations, it is respectfully disagreed that the limitions are not disclosed. 

Puz discloses "wherein said tag specifies at least one parameter field and at least one 
parameter value;"[figure 2 elements 46, 48, 50. Accordingly, wherein said tag (46, 48, 50) 
specifies at least one parameter field (marker 1, 2, 3) and at least one parameter value 
(employee_3, journal_l, none)] 
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"in response to receiving the request, said database server storing information from the 
tag in a manner that is associated with said database statement and accessible to a tag 
access mechanism: "[figure 2 and figure 3. Accordingly, in response to receiving the request 
(figure 2 elements 34, 36, 38), said database server (figure 2 element 16) storing information 
from the tag (figure 2 element 46, 48, 50) in a manner that is associated with said database 
statement (figure 2 element 40, 42, 44) and accessible to a tag access mechanism (0030, Access 
Control List checks)] 

"said database server executing said database statement, wherein during execution of said 
database statement said database server provides access to one or more of the at least one 
parameter value through said tag access mechanism provided by said database server."[figure 2 
and 4. Accordingly, said database server executing said database statement (figure 4 elements 
82-86), wherein during execution of said database statement (figure 4 elements 82-86) said 
database server (figure 2 element 16) provides access to one or more of the at least one 
parameter value (figure 4 element 82, a marker part to a server system for processing) through 
said tag access mechanism (figure 4 element 84, ACL checks on the markers) provided by said 
database server (figure 2 element 16)] 

Regarding Puz fails to show a database server that has access to a parameter value of the 
tag during execution of the database statement, this is disagreed. Puz discloses on paragraph 
0033, "at this point, the query parts 34, 36, 38, each query part including the respective SQL part 
40, 42, 44 and any respective inserted security marker 46, 48, are sent to a server system (82) for 
a second phase of query processing." Shown more explicitly, Puz shows, a database server 
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(figure 1 element 16) that has access to a parameter value (figure 4 element 84, analyzes 
security marker) of the tag (figure 2, security marker) during execution (paragraph 33, query 
processing) of the database statement (figure 2 elements 34, 36, 38). 

Regarding, that Puz does not use the security marker during execution of the database 
statement. This is an incorrect statement because Puz does use the security marker during 
execution of the database statement, see at least paragraph 33 and figure 4. The query processing 
(i.e. execution of the database statement) uses the security marker as shown in Puz figure 4 
which demonstrates the query processing procedures of Puz. 

Regarding, that Puz replaces the security marker prior to execution of the database 
statement and that therefore the database server never access the parameters. This is incorrect 
because Puz discloses that the execution of the database statement occurs in figure 4 after 
element 72, where the query is entered into the system. The query is then processed (i.e. 
executed by the system) in figure 4 elements 74-86. The database server (figure 1 element 16) 
does have access to the parameter values (figure 4 element 84, analyzes security marker) of the 
tag (figure 2 security marker). That the security markers are sent to the server, and processed as 
seen in paragraph 33 of Puz. 

Regarding, that the security marker is replaced before the SQL string is submitted to the 
database server, and that the database server in Puz does not receive the security marker. This 
is respectfully disagreed as can be seen in paragraph 33 where it states that "at this point, the 
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query parts 34, 36, 38, each query part including the respective SQL part 40, 42, 44 and any 
respective inserted security marker 46, 48, are sent to a server system (82) for a second phase of 
query processing." In other words, the security markers (tags) are received by the server (i.e. 
database server). The server (i.e. database server) therefore is able to access the security markers 
during query processing (i.e. execution of the database statement) because the server analyzes 
the security markers (i.e. access to a parameter value of the tag) as seen in figure 4 element 84. 

C. Page 16, that Puz and Fujiwara do not disclose a tag that is (a) included in a 
request to execute a database statement, and (b) not embedded in the database statement; 
and further do not disclose a database server that has access to a parameter value of the 
tag during execution of the database statement. And finally assert that they are not 
combinable. 

In response, to Puz and Fujiwara do not disclose a tag that is (a) included in a request to 
execute a database statement, and (b) not embedded in the database statement, please see part A 
above. 

In response to Puz and Fujiwara do not disclose a database server that has access to a 
parameter value of the tag during execution of the database statement, please see part B above. 

In regards to the combination cannot be made, this is disagreed. Both Puz and Fujiwara 
are within the same field of endeavor as they are both access control systems for a database 
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query. They are further within the same field of endeavor as applicant's invention. It would 
have been obvious to a person of an ordinary skill at the time the invention was made to have 
applied Fujiwara's disclosure above to the disclosure of Puz for the purpose of allowing an 
access policy to be determined in order to provide for easier management of access control to 
each user. By allowing an access policy in Fujiwara it further allows for managing better control 
over Puz's security for each user access. 

(11) Related Proceeding(s) Appendix 

No decision rendered by a court or the Board is identified by the examiner in the Related 
Appeals and Interferences section of this examiner's answer. 

For the above reasons, it is believed that the rejections should be sustained. 
Respectfully submitted, 
/Michael Pham / 
Examiner, Art Unit 2167 
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/John R. Cottingham/ 

Supervisory Patent Examiner, Art Unit 2167 

/Khanh B. Pham/ 

Primary Examiner, Art Unit 2166 



